Recently, with Web-based applications for business systems increasing and Internet businesses spreading, the scale of businesses handled by Web systems has been expanding. In such a situation, it is absolutely necessary to enhance the reliability of Web systems. Abnormalities occurring in Web systems are, however, quite diversified, and causes for such abnormalities also vary widely, for example, from software bugs to operator errors. It is, therefore, difficult to completely prevent the occurrence of such abnormalities. Hence, based on the idea that the occurrence of abnormality in a Web system is inevitable, various techniques for abnormality detection have been developed so as to allow appropriate measures to be taken quickly when abnormality is detected. In recent Web systems increasingly having concealed structures using components from multiple vendors, it is often difficult to obtain data about system abnormalities. Against such a background, abnormality detection techniques have been proposed in which model data on system performance is generated based on past normal performance information, which is relatively easily obtainable, then abnormality is determined based on the degree of difference between the model data and current performance information.
In terms of the present invention, the term “abnormality” refers to a system status in which it may occur that the Service Level Agreement (SLA) is not met due to, for example, a hardware stoppage or malfunction, a CPU or network overload, or a memory area shortage. Also, the term “model data” refers to typical normal performance information obtained, for example, by averaging past normal performance information.
Among existing techniques for abnormality detection, there are those disclosed in JP-A No. 2001-142746 and JP-A No. 2008-191839. In the technique disclosed in JP-A No. 2001-142746, load model data representing transition with time of the load on a computer system is generated based on past load information on the computer system, a threshold load value is determined using the load model data for a time corresponding to the current time, and system abnormality is determined according to whether or not the current load exceeds the threshold load value. In the technique disclosed in JP-A No. 2008-191839, pattern data representing periodic changes in performance of a computer system is generated based on past performance data and, when the current performance data does not match any past pattern included in the generated pattern data, the computer system is determined to have abnormality.